🛡️ SecureLogin

Enterprise-Grade Password Authentication, Automatic Session Verification & Cryptographic Proxy Security
Developed by Chéngzé

SecureLogin is a modern, lightweight, and ultra-low-overhead authentication and security plugin designed for Paper / Purpur (1.21.x+) and proxy networks (BungeeCord, Waterfall, Velocity). Built for proxy-forwarded backends (online-mode=false behind a proxy), development environments, and servers requiring secondary password protection, SecureLogin secures player identities using modern cryptography with zero main-thread lag.

✨ Key Features

• 🚀 Automatic Mojang Session Verification: Players with verified Mojang sessions are authenticated automatically during the handshake, allowing seamless entry without requiring manual /register or /login commands.
• 📱 Native Geyser & Floodgate (Bedrock) Support: Zero-dependency detection for Floodgate (00000000-0000-0000-... Xbox Live UUIDs). Verified Bedrock sessions can automatically bypass password prompts (configurable), while prefix validation prevents username collisions between Java and Bedrock accounts.
• 🌐 Dual Deployment Architecture (2-in-1):
  • Standalone Mode (Single Server): Run SecureLoginBackend on a single Paper/Purpur server to provide in-game password authentication and session protection.
  • Proxy Auth-Lobby Mode (Network): Pair SecureLoginProxy + SecureLoginBackend to isolate unauthenticated connections in a dedicated Auth Lobby and automatically route verified players to your hub server.
• 🔐 HMAC-SHA256 Proxy-to-Backend Bridge: Every proxy-to-backend authentication state is signed with HMAC-SHA256, timestamped, and protected by a one-time cryptographic nonce cache—eliminating direct-backend port bypasses, packet spoofing, and replay attacks.
• ⚡ Ultra-Low Resource Usage: Engineered with asynchronous HikariCP database workers, cached MethodHandle reflection, and an idle-sleep ticker that consumes 0% CPU when all online players are authenticated.

🔒 Security & Account Protection

• BCrypt Password Hashing: Industry-standard salted hashing (cost=12) ensures plaintext passwords are never stored or logged.
• Username Prefix & Symbol Filter: Prevents Floodgate prefix collisions (., -, +) across mixed Java/Bedrock environments.
• IP Registration Limiter: Mitigates automated bot attacks with a configurable maximum registration limit per IP address (max-accounts-per-ip).
• Smart IP Session Resumption: Returning players connecting from their verified IP address automatically resume their active session until expiration.
• Brute-Force Lockout: Configurable maximum failed login attempts and temporary account lockouts.

⌨️ Commands & Permissions

Full administrative access node: securelogin.admin

🔌 Integrations & Storage

• Databases: SQLite (out-of-the-box default) and MySQL / MariaDB (HikariCP pooled).
• LuckPerms: Registers real-time contexts (securelogin:authenticated and securelogin:premium).
• PlaceholderAPI:
  • %securelogin_is_authenticated% (true / false)
  • %securelogin_account_type% (Premium / Password)
• UI & Formatting: Full Kyori Adventure MiniMessage support with customizable gradients, BossBar countdowns, ActionBars, and Titles.